Plumb through out_row byte length so we can assert we stay underneath it.

src/opts/SkBitmapFilter_opts_SSE2.cpp

 /*
  * Copyright 2013 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include <emmintrin.h>
 #include "SkBitmap.h"
 #include "SkBitmapFilter_opts_SSE2.h"
@@ skipping 156 matching lines @@
         out_row += 4;
     }
 }
 
 // Convolves horizontally along four rows. The row data is given in
 // |src_data| and continues for the num_values() of the filter.
 // The algorithm is almost same as |ConvolveHorizontally_SSE2|. Please
 // refer to that function for detailed comments.
 void convolve4RowsHorizontally_SSE2(const unsigned char* src_data[4],
                                     const SkConvolutionFilter1D& filter,
-                                    unsigned char* out_row[4]) {
+                                    unsigned char* out_row[4],
+                                    size_t outRowBytes) {
+    SkDEBUGCODE(const unsigned char* out_row_0_start = out_row[0];)
+
     int num_values = filter.numValues();
 
     int filter_offset, filter_length;
     __m128i zero = _mm_setzero_si128();
     __m128i mask[4];
     // |mask| will be used to decimate all extra filter coefficients that are
     // loaded by SIMD when |filter_length| is not divisible by 4.
     // mask[0] is not used in following algorithm.
     mask[1] = _mm_set_epi16(0, 0, 0, 0, 0, 0, 0, -1);
     mask[2] = _mm_set_epi16(0, 0, 0, 0, 0, 0, -1, -1);
@@ skipping 80 matching lines @@
         accum1 = _mm_srai_epi32(accum1, SkConvolutionFilter1D::kShiftBits);
         accum1 = _mm_packs_epi32(accum1, zero);
         accum1 = _mm_packus_epi16(accum1, zero);
         accum2 = _mm_srai_epi32(accum2, SkConvolutionFilter1D::kShiftBits);
         accum2 = _mm_packs_epi32(accum2, zero);
         accum2 = _mm_packus_epi16(accum2, zero);
         accum3 = _mm_srai_epi32(accum3, SkConvolutionFilter1D::kShiftBits);
         accum3 = _mm_packs_epi32(accum3, zero);
         accum3 = _mm_packus_epi16(accum3, zero);
 
+        // We seem to be running off the edge here (chromium:491660).
+        SkASSERT(((size_t)out_row[0] - (size_t)out_row_0_start) < outRowBytes);
+
         *(reinterpret_cast<int*>(out_row[0])) = _mm_cvtsi128_si32(accum0);
         *(reinterpret_cast<int*>(out_row[1])) = _mm_cvtsi128_si32(accum1);
         *(reinterpret_cast<int*>(out_row[2])) = _mm_cvtsi128_si32(accum2);
         *(reinterpret_cast<int*>(out_row[3])) = _mm_cvtsi128_si32(accum3);
 
         out_row[0] += 4;
         out_row[1] += 4;
         out_row[2] += 4;
         out_row[3] += 4;
     }
@@ skipping 197 matching lines @@
 void applySIMDPadding_SSE2(SkConvolutionFilter1D *filter) {
     // Padding |paddingCount| of more dummy coefficients after the coefficients
     // of last filter to prevent SIMD instructions which load 8 or 16 bytes
     // together to access invalid memory areas. We are not trying to align the
     // coefficients right now due to the opaqueness of <vector> implementation.
     // This has to be done after all |AddFilter| calls.
     for (int i = 0; i < 8; ++i) {
         filter->addFilterValue(static_cast<SkConvolutionFilter1D::ConvolutionFixed>(0));
     }
 }